The validate JSON endpoint of Secvisogram’s csaf-validator-service in versions prior to 0.1.0 processes tests with unexpected names (CWE-20). In addition to the valid test names defined in csaf-validator-lib, inherited JavaScript object function names such as constructor, toString, and isPrototypeOf are also executed. An unauthenticated remote attacker can exploit this insufficient input validation to cause a partial denial of service, though only the attacker’s own request is affected. Version 0.1.0 introduced validation of test names; updating to version 1.0.1 or later is recommended to also avoid potential version confusion between the API/documentation version and the package version.

BSI advisory: BSI-2022-0004.